From 7a54e92f170cfc75cf644680f672438693e6dfb9 Mon Sep 17 00:00:00 2001 From: Mira Weller Date: Wed, 22 Jul 2026 17:16:29 +0200 Subject: [PATCH] Add tests to prevent reintroducing CSP nonces, as discussed in PR #6387 (Z#23240534) --- src/tests/control/test_views.py | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/src/tests/control/test_views.py b/src/tests/control/test_views.py index f169df7024..0331b31f3b 100644 --- a/src/tests/control/test_views.py +++ b/src/tests/control/test_views.py @@ -224,3 +224,31 @@ def test_one_view(logged_in_client, url, expected, event, item, item_category, o ) response = logged_in_client.get(url) assert response.status_code == expected + + +@pytest.mark.django_db +def test_csp_header_control(logged_in_client): + # Do not reintroduce any CSP nonces into control responses, as discussed in PR #6387 + response = logged_in_client.get('/control/') + assert response.status_code == 200 + assert 'nonce-' not in response['Content-Security-Policy'] + + +@pytest.mark.parametrize('url', [ + '/control/login', + '/', + '/{orga}/{event}/', +]) +@pytest.mark.django_db +def test_csp_header_unauthenticated(client, url, event): + # Do not reintroduce any CSP nonces into most presale responses, as discussed in PR #6387 + with scope(organizer=event.organizer): + url = url.format( + event=event.slug, orga=event.organizer.slug, + ) + event.live = True + event.save() + response = client.get(url) + assert response.status_code == 200 + assert 'script-src' in response['Content-Security-Policy'] + assert 'nonce-' not in response['Content-Security-Policy']